DAC8 and CARF readiness guide for the first reporting cycle

A working guide for accounting firms and crypto-asset service providers preparing for their first DAC8 and CARF reporting cycle. It covers what the regime is, who falls in scope, the dates that matter, the data you have to be able to produce, and the controls worth having in place before the first reporting year closes.

General information, not legal, accounting or tax advice. Confirm your specific obligations against the directive as transposed in each member state and with a qualified advisor.

What the regime is

DAC8 is Council Directive (EU) 2023/2226, which extends the EU Directive on Administrative Cooperation to crypto-assets. It requires Reporting Crypto-Asset Service Providers (RCASPs), meaning exchanges, brokers, certain wallet providers and other platforms facilitating crypto transactions for customers, to carry out due diligence on their users and to report identity, tax residence and transactions to national tax authorities.

DAC8 is the EU implementation of the OECD Crypto-Asset Reporting Framework (CARF), so the two are deliberately aligned. For a provider facing both, that alignment is the single most useful planning fact in this guide: the underlying dataset is substantially the same, and building one reconciled, attributed record set serves both outputs rather than requiring two parallel processes. The full background sits on the DAC8 page and the CARF page.

Who is in scope

The obligation attaches to Reporting Crypto-Asset Service Providers. In practice that means asking a question about substance rather than self-description: does your business facilitate crypto transactions for customers, or does it simply hold crypto on its own account. A corporate treasury holding digital assets for itself sits in a very different position from an exchange, a brokerage or a custody service through which customers transact.

Scope determination is not a footnote to the exercise, it is part of it. Document why you concluded that a given entity, product line or customer population is or is not reportable, and keep that reasoning with the figures. A defensible scope rationale is as much a part of the file as the numbers themselves. Because the directive is transposed into national law by each member state, the precise definition, registration mechanics and filing format that apply to your business must be confirmed against the directive as transposed locally and with a qualified advisor.

The timeline

• Transposition: EU member states were to transpose DAC8 into national law by 31 December 2025.
• First reporting year: reporting obligations apply from 1 January 2026, which is the first reporting year.
• First reports: reports covering the 2026 calendar year are due in 2027, broadly between January and September 2027 depending on the member state.

The practical consequence is that data quality for the first filing is determined by what you captured during 2026, not by what you can assemble in 2027. Attribution reconstructed after the fact is weaker than attribution captured at the transaction, and in some cases it simply cannot be rebuilt. Confirm your own member state deadline within that window rather than assuming a common date across the EU.

What data has to be collectable

The regime organises reporting by person, not in aggregate, which changes what a good record looks like. A movement that is correctly valued and classified for your accounts is not automatically adequate for reporting: it also has to carry the customer attribution and residence context the report is built around.

User identity and tax residence

Validated customer information gathered through due-diligence procedures, including tax identification and residence, applied to both new and pre-existing users, and kept current. This is the part that most often lags, because it depends on customer response rather than on your own systems.

Transaction detail

Transaction-level records captured once and never silently overwritten, so any reported total can be re-derived from source. Date, asset, quantity and value, joined to the party behind the movement and to the classification of the activity. Valuation provenance matters here too: the source and date behind each converted value should be visible, so a figure's derivation can be shown rather than asserted.

Correction history

A tracked record of restatements. A filing amended without a change history reads as an inconsistency; the same amendment with a documented trail reads as a managed correction.

Readiness steps before the first reporting year closes

Common failure points

• Treating reporting as a year-end export. The context the report needs is created at the transaction, not at the close.
• A report that does not tie to the accounts. Reconcile once at the ledger and let both the accounts and the report draw on the reconciled result.
• Assuming a common EU deadline. The first reports are due broadly between January and September 2027 depending on the member state.
• Assuming non-EU means out of scope. Confirm your position against the directive as transposed and with your advisor rather than inferring it.
• Running DAC8 and CARF as separate projects. They are aligned by design; generate both from one reconciled dataset.

How a sub-ledger carries this

CryptaCount holds activity from wallets, chains and connected venues in one reconciled crypto sub-ledger, carries the per-transaction context reporting depends on, and keeps an auditable trail behind every figure, so a reported number traces to the posting it came from. Because the same reconciled dataset produces the accounts and the report, there is one version of the truth rather than two kept in step by hand. The specifics of scope, registration and format for your business remain matters to settle against the directive as transposed in each member state and with a qualified advisor.

General information, not legal, accounting or tax advice. Confirm your obligations against the directive as transposed in each relevant member state and with a qualified advisor.